Re: Cannot perform signing when multiple keys are present

Douglas E Engert <[email protected]>
Newsgroups gmane.comp.encryption.opensc.devel
Message-ID <[email protected]>

On 12/19/2016 8:45 AM, Marcin Okraszewski wrote:
> Hi Douglas,
> Thank you for explanation. So, what I understand here, if only there is connection to the reader, I should be able to use the token from OpenSSL via libp11.

I believe I understand your comment, If only one PIV like card is present.


> The token is visible, as I'm able to
> initialize it, generate key, import certificate via Yubico's piv-tool.

Yes, these use PCSC but not any PKCS#11.



> But I'm not able even to list tokens with p11tool. Note, I don't specify any configuration. I just install OpenSC and run
> "gnutls-3.4.9\bin\p11tool.exe --provider c:\Windows\System32\opensc-pkcs11.dll  --list-tokens". I run it as administrator.

I can not speak to how p11tool should work.
Is there some 32 bit opensc-pkcs11.dll with 64 bit p11tool?
You are running in a cmd window?

What does the OpenSC pkcs11-tool.exe -O -l show?

Do you get any output?

>
> When it comes to Device Manager, the card is not being recognized even if I regenerate CHUID, unplug and plug token again or even reboot Windows (2012 R2). The CHUID is being set and I can see the
> value being changed by status action.

When you regenerated the CHUID, did it tell you what it did?
There was a bug in in how Yubico created a CHUID It was fixed in 2014. Are you using an old version?
https://github.com/Yubico/yubico-piv-tool/issues/9

I believe there is a verbose option for yubico-piv-tool to list the chuid, or list it while it is created.


Also see:

https://github.com/OpenSC/OpenSC/wiki/Using-OpenSC

on how to setup a opensc debug log and an opensc SPY log.

These would show what might be going on. It would also show if the CHUID was being read, and it binary value.


>
> Thanks,
> Marcin
>
> On Fri, Dec 16, 2016 at 5:19 PM, Douglas E Engert <[email protected] <mailto:[email protected]>> wrote:
>
>
>
>     On 12/16/2016 8:54 AM, Marcin Okraszewski wrote:
>
>         I think I have the root cause, which lies completely elsewhere. Apparently Yubikey driver doesn't install properly on this machine. Normally you Yubikey is visible in Device Manager under
>         Smart cards
>         section as "Identity Device (NIST SP 800-73 [PIV])".
>         On that machine I see "Unknown Smart Card" (see attached screenshots). I don't know yet why is it so, but this is out of scope for this group I
>         guess.
>
>
>     Microsoft has its own PIV smart card driver used with its CAPI and minidrivers.
>     Google for: microsoft PIV and for:microsoft minidriver
>
>     So for PIV cards at least, unless you need PKCS#11 you don't need third party software.
>     What I think you are seeing in device manager is the fact the Microsoft recognizes its a PIV card.
>     But the Microsoft code requires a CHUID on the card to recognize it as a PIV. The NIST 800-73 says the CHUID is a mandatory.
>     Yubico may or may not provide their own driver, but as I understand it, the reason for Yubico to present a PIV
>     interface is to not require additional software.
>
>     OpenSC and other vendors provide software that interfaces with smart cards at the PCSC level just like on the Linux.
>     so all that is needed is access the readers.
>     OpenSC and other vendors also provides a minidriver that can access any smartcard OpenSC supports, so one can get
>     CAPI access to card. But this also requires registry changes to list the ATRs of the cards supported.
>
>
>         Sorry, I was so mislead with the fact there are two tokens and that other tools does see Yubikey that I didn't even thought of checking it. Only the empty list from p11tool and together with
>         Douglas pointing other tools are not use PKCS#11 module triggered finally the thought check it.
>
>         For completeness, here is the debug output from p11tool:
>
>             \gnutls-3.4.9\bin\p11tool.exe --provider c:\Windows\System32\opensc-pkcs11.dll  --list-tokens
>
>         (p11-kit:2992) p11_library_init: initializing library
>         (p11-kit:2992) p11_kit_module_load: in: c:\Windows\System32\opensc-pkcs11.dll
>         (p11-kit:2992) load_module_from_file_inlock: loading module from path: c:\Windows\System32\opensc-pkcs11.dll
>         (p11-kit:2992) dlopen_and_get_function_list: opened module: c:\Windows\System32\opensc-pkcs11.dll
>         (p11-kit:2992) p11_kit_module_load: out: success
>         (p11-kit:2992) p11_kit_module_release: in
>         (p11-kit:2992) p11_kit_module_release: out
>         (p11-kit:2992) uninit_common: uninitializing library
>
>         Thank you,
>         Marcin Okraszewski
>
>
>         On Thu, Dec 15, 2016 at 9:08 PM, David Woodhouse <[email protected] <mailto:[email protected]> <mailto:[email protected] <mailto:[email protected]>>> wrote:
>
>             On Thu, 2016-12-15 at 19:18 +0100, Marcin Okraszewski wrote:
>             >
>             > It provides no output, there. So, it looks like the p11 doesn't see
>             > the token at all (while other tools does). Removing the other token
>             > doesn't help too.
>
>             Sounds like your PKCS#11 provider module is installed without a
>             corresponding p11-kit .module file to let applications know where to
>             find it automatically.
>
>             That is unfortunately the case even on poorly-maintained Linux
>             distributions; it's not surprising that it's the case on Windows.
>             You'll probably have to make the .module file manually.
>
>             https://p11-glue.freedesktop.org/doc/p11-kit/pkcs11-conf.html <https://p11-glue.freedesktop.org/doc/p11-kit/pkcs11-conf.html> <https://p11-glue.freedesktop.org/doc/p11-kit/pkcs11-conf.html
>         <https://p11-glue.freedesktop.org/doc/p11-kit/pkcs11-conf.html>>
>             --
>             dwmw2
>
>
>
>     --
>
>      Douglas E. Engert  <[email protected] <mailto:[email protected]>>
>
>

-- 

  Douglas E. Engert  <[email protected]>


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/intel
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.